CVE-2024-27955: 
WordPress vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the WordPress Automatic plugin, tracked as CVE-2024-27955. The vulnerability affects versions up to 3.92.0 of the Automatic plugin and allows privilege escalation. The issue was publicly disclosed on March 13, 2024, by security researcher Rafie Muhammad from Patchstack (Patchstack Database).

The vulnerability has been assigned a CVSS v3.1 base score of 8.3 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. The issue is classified under CWE-352 (Cross-Site Request Forgery) and could allow attackers to force higher privileged users to execute unwanted actions under their current authentication (NVD, Patchstack Database).

The vulnerability enables attackers to potentially escalate privileges through CSRF attacks. This could lead to unauthorized administrative actions being performed on affected WordPress sites when exploited successfully (Wordfence).

The vulnerability requires no authentication (PR:N) but does need user interaction (UI:R) and has high attack complexity (AC:H). The attack can be initiated from the network (AV:N) and has potential for high impacts on confidentiality, integrity, and availability (Patchstack Database).

The vulnerability has been patched in version 3.92.1 of the WordPress Automatic plugin. Users are strongly advised to update to this version or later to mitigate the security risk (Patchstack Database).